/gcp_iam

Utility functions to troubleshoot for GCP IAM Permissions, Roles and Resources

Primary LanguageGoApache License 2.0Apache-2.0

Google Cloud IAM Troubleshooting scripts intended to provide several indicators of users permissions on GCP resources.

  • inspect/query

    • checkEndUserPermissions

      • Allows an end user to ask "of all the permissions this resource accepts, which ones do I have?"
      • Allows a domain administrator to impersonate any user and inspect which permissions that user has on a resource.

    • usePolicyTroubleshooter

      • Use IAM Policy Troubleshooter API to determine if the user has IAM access to a resource.

      • Display if IAM Conditions are applicable.

      • Backtrack the IAM Resource Hierarchy from the resource to root and display all the IAM Roles present at each node. (TODO: display subset of permissions at each node applicable to the target resource)

    • useIAMPolicyRequest

      • Use IAM Policy Analyzer to help determine if a given user has access to a resource through indirect capabilities:

        • Through nested or direct group memberships bound to the resource
        • Through service account impersonation where the service account has direct or indirect access.
        • Other mechanisms described here

  • map/

    The other utility provided here is basically just a forward and reverse map and graph of IAM Roles->Permissions and Permissions->Roles. Mostly just fun stuff

    See Google Cloud IAM Roles-Permissions Public Dataset

Note that users can have access to resources through various mechanisms and restrictions:

Each of these scripts attempts to surface aspects of these access capabilities and restricts. The intent is to use them to surface the full access scope capability for a user.

** This code is NOT supported by Google, really **

NOTE: this utility is just a way to list and test Roles/Permissions. It does not account for IAP Context-Aware access, VPC-SC or IAM Conditions

References